Security scanner

devlo adds a Security Scanner to Automations when you connect GitHub. It’s off until you turn it on. On its schedule, weekly to start or daily if you change it, the scanner reads every repository in its scope at the default branch and looks for vulnerable dependencies, secrets in code and configuration, injection risks, authentication and authorization gaps, weak cryptography, risky configuration and CI, and data exposure.

What it opens

• One issue per confirmed finding, titled [Security] <Severity>: <what and where> and labelled security plus a severity label, with the file and line, how an attacker reaches it, the impact, the evidence and references. It reports a secret’s location, never its value.
• A pull request for each safe fix, on a branch named devlo/security/<slug>, with the smallest change that closes the issue. Changes that need a decision, such as an authentication model change, a breaking dependency upgrade or a secret rotation, get a plan in the issue instead.

devlo never merges. Review the pull request as you would any other. A run opens at most a few issues and pull requests and remembers what it covered, so large repositories are scanned across several runs and nothing is reported twice.

Turn it on

1. Open Automations and select Security Scanner.
2. Set Scope. It starts on All repositories; on Free, scheduled runs cover one repository.
3. Keep the weekly schedule or switch it to daily, pick a Model if you want a different one, then save.
4. Turn it on. Test run starts a scan now.

Each run uses credits. Rerunning your tests before devlo opens a pull request needs Startup or higher.

Tip

The scanner is an ordinary automation. Edit its Instructions to add exceptions for your codebase, or add Send Email on a paid plan to get a summary after each run.

Related

• How automations work
• Triggers and capabilities
• Code review covers the pull requests your team opens.